Lacework
Access helpful articles and other FAQs on Lacework
Kate_M
Community Manager
Community Manager
Article Id 334318
Description

ArgoCD can fail to deploy agent when using a custom Helm release name. 

 

The error seen may refer to invalid or missing lacework-agent.image, such as:

 

Failed to load target state: failed to generate manifest for source 1 of 1: rpc error: code = Unknown desc = `helm template . --name-template lacework --namespace lacework --kube-version 1.26 --values <path to cached source>/values.yaml <api versions removed> --include-crds` failed exit status 1: Error: template: lacework-agent/templates/_helpers.tpl:38:28: executing "lacework-agent.image" at <.Values.image.registry>: nil pointer evaluating interface {}.registry Use --debug flag to render out invalid YAML

 

Scope ArgoCD deploying Lacework agents to Kubernetes via the Agent Helm chart.
Solution

 The error seen above is not a relevant pointer to the actual cause in this case. It is, however,  possible to observe this error from other root causes.

 

Determination of whether the error message is caused by the issue documented here should be based on the result of testing the helm chart without ArgoCD:

 

  • If, when using the same helm chart outside of ArgoCD, the agent then manages to deploy successfully, the issue is specific to ArgoCD and likely the one documented here. If, however, the same error is still observed with or without ArgoCD, then other causes should be considered, for example this documented helm issue: https://github.com/helm/helm/issues/8026 

This error is seen where the ArgoCD configuration includes the definition of a custom “helm release name” for the lacework agent (the default is “lacework-agent”).

 

Because the Lacework agent sets the app.kubernetes.io/instance label in the helm chart to the default value of “lacework-agent” (example below), the use of a custom release name results in ArgoCD being unable to correctly load the helm chart, as it refers to this label to track the application.

 

   labels:

        app.kubernetes.io/name: {{ include "lacework-agent.name" . }}

        app.kubernetes.io/instance: {{ include "lacework-agent.name" . }}

        name: {{ include "lacework-agent.name" . }}-cluster


This could affect any resource deployed via ArgoCD and is not specific to the Lacework agent. Further detail is provided in the ArgoCD documentation (see “Related Documentation” section below.

 

The resolution is either to not define a custom release name, allowing it to use the default (“lacework-agent”), or to follow the ArgoCD documentation regarding setting of an alternative application label to track via the application.instanceLabelKey property that does align with the custom release name.

 

Related Documentation

https://argo-cd.readthedocs.io/en/stable/user-guide/helm/#helm-release-name

 

 

Contributors